AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

linkisGHSA-j6vx-r77h-44wc

Apache Linkis arbitrary file deletion vulnerability

linkis

CVE-2024-27182 · Published Aug 2, 2024 · updated Mar 27, 2025

High4.9
Fix: upgrade to 1.6.0 or later
GitHub advisory

In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on a user with an administrator account could delete any file accessible by the Linkis system user. Users are recommended to upgrade to version 1.6.0, which fixes this issue.

Affected versions

PackageAffectedFixed in
org.apache.linkis:linkis
Maven
< 1.6.01.6.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-552
Also known as
CVE-2024-27182

More linkis advisories

All linkis
High 7.5Jan 19Apache Linkis: Arbitrary File Read via Double URL Encoding BypassCVE-2025-29847fixed in 1.8.0High 5.3Aug 2, 2024Apache Linkis vulnerable to privilege escalationCVE-2024-27181fixed in 1.6.0Medium 5.3Mar 6, 2024Apache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedCVE-2023-50740fixed in 1.5.0Critical 9.1Jul 6, 2023Apache Linkis Authentication Bypass vulnerabilityCVE-2023-27987fixed in 1.3.2Critical 9.8Jul 6, 2023Apache Linkis Zip Slip issueCVE-2023-27603fixed in 1.3.2Critical 9.8Jul 6, 2023Apache Linkis Unrestricted File Upload vulnerabilityCVE-2023-27602fixed in 1.3.2